Crash dumps

[dbartt]

I recently noticed several TCMD crash dumps in %localappdata%\crashdumps and I don't know how to report them. There is no visible error message, just the dump file. May be occurring from a session run from Task Scheduler.
How do I proceed to analyze the cause? Is there a place I should send the dmp file?

 

[vefatica]

I think that in Windows 10, they're automatically sent to Microsoft (and you don't get any feedback). I have read that you don't automatically get local-user copies (in %localappdata%\crashdumps). You must have enabled that. See this page. You'll probably find more (and human-readable) results in the event log. Filter the "application" event log for errors and event ID 1000. I get ones like this (below) randomly from the unloading of plugins.

 

[vefatica]

@Charles Dye ...

Do you regularly load any of your many plugins? If so, do you get reports like the one above? As I said, I get them randomly and not very often from two of mine, apparently when TCC is terminating. You can also see the reports in Start\Reli(ability monitor).

 

[dbartt]

Thanks. That info helps.

I can see the failing module is either tcmd.exe or tcc.exe and I have determined the crash only happens after I shut down TCMD but not a crash dump after every shut down.

Appears to be similar to your situation. It's random although I don't use any plugins.

In my case the faulting application and module varies. It's either tcmd.exe/ntdll.dll or tcc.exe/tcc.exe.

Something during shutdown.

 

[Charles Dye]

@Charles Dye ...

Do you regularly load any of your many plugins? If so, do you get reports like the one above? As I said, I get them randomly and not very often from two of mine, apparently when TCC is terminating. You can also see the reports in Start\Reli(ability monitor).

In Event Viewer, you mean? I'm not seeing anything like that:

I do have a few tcc.exe.* files in the CrashDumps directory. I'm guessing those are my own fault; my code doesn't always work correctly on the first try!

 

[vefatica]

Charles, you're filtering on Source = 1000. You should filter on EventID = 1000.

 

[vefatica]

Hmmm! I don't even have a %LOCALAPPDATA\CrashDumps directory (and I have plenty of crashes)! Did you (Charles and Dbartt) enable user level dumps (as in the link I posted).

 

[dbartt]

I don't have the registry entries but I do get the crash dumps.

I have three instances from Event Viewer with differenet combinations of TCMD, TCC and NTDLL.

 

[Charles Dye]

Charles, you're filtering on Source = 1000. You should filter on EventID = 1000.

Ah, my mistake. When I filter on EventID = 1000, I do see a lot of events. Some of those are TCC, and many of those do cite plugins of mine.

 

[dbartt]

Sorry, I didn't select those images properly. Will try again later

 

[vefatica]

If you can get DUMPEL.EXE (NT4/Win2000 (?) Resource Kit, 20+ years old and still works) investigating these things can be made easier. It's hard to use and its output is horrendous.

I've done these tests (see below) several times. With no plugins I get no crashes. With plugins I get a crash with probability about 10%.

v:\> 2>NUL dumpel -t -e 1000 -format dts -l application -m "Application Error" | grep -i tcc.exe | wc -l
241

v:\> do i=1 to 100 ( start %comspec /ip exit)

v:\> 2>NUL dumpel -t -e 1000 -format dts -l application -m "Application Error" | grep -i tcc.exe | wc -l
241

v:\> do i=1 to 100 ( start %comspec exit)

v:\> 2>NUL dumpel -t -e 1000 -format dts -l application -m "Application Error" | grep -i tcc.exe | wc -l
252

 

[dbartt]

I still have my Win NT and Win 2K Resource Kits and I might try DUMPEL. I did try WINDBG from the MS store but it doesn't give any useful information.
Not sure how much time I want to spend on this since it doesn't affect anything I do. Just the event reports and crash dumps. Curiously, event viewer shows a mix of crashes, TCMD v 28 faulting in NTDLL.DLL, TCC v28 faulting in NTDLL.DLL, and TCC v 17 faulting in TCC.EXE. I don't use plugins so no hints there.

 

[vefatica]

I feel the same way. It doesn't affect me or my computer. So I really don't care. I don't use TCMD much but I still have 47 crashes, 252 crashes from TCC and 855 from other apps. They include crashes of svchost.exe, searchapp.exe, shellexperiencehost.exe, explorer.exe, OLicenseHeartbeat.exe, Microsoft.Photos.exe, ScreenClippingHost.exe (and more).

 

[David Marcus]

Try running "sfc /scannow".